TeamPCP Strikes Again: Telnyx Python SDK (790K Monthly Downloads) Hit with Credential-Stealing Malware

You may read similar articles or content for different packages or for the same package, but with the same context. It is happening again. Four waves. Nine days. Five ecosystems. Over 1,000 organizations affected.

On March 27, 2026, the Telnyx Python SDK on PyPI was compromised. Versions 4.87.1 and 4.87.2 contain credential-stealing malware published using stolen publishing credentials. PyPI has quarantined both versions. Safety has verified version 4.87.0 as clean and tracks this incident as SFTY-20260327-08904, linked to SFTY-20260324-28516 (LiteLLM, March 24).

If you are running telnyx >= 4.87.1, pin to 4.87.0 immediately, treat the environment as compromised, and follow the remediation steps at the bottom of this post.

The Chain and the questions that remain unasked

The causation chain is well-documented by now. Incomplete credential rotation after a February 28 breach left TeamPCP with residual access to Aqua Security's Trivy. On March 19, they weaponized it — injecting a credential stealer into CI/CD pipelines used by over 10,000 workflows. From there, stolen npm tokens fed a worm that infected 66+ packages on March 20. Compromised Checkmarx GitHub Actions on March 23. A PyPI token exfiltrated from LiteLLM's CI pipeline — which ran unpinned Trivy — on March 24. And on March 27, Telnyx, most likely via a token harvested from a LiteLLM-compromised environment.

But here is the question worth pausing on: did TeamPCP choose these targets?

Considering the npm wave. Twenty-eight packages across one publisher scope were compromised in under 60 seconds. That is not target selection. That is automation running through a credential dump, publishing to everything the stolen tokens could reach.

Now asking the same question about LiteLLM. Was it targeted because it is an AI gateway holding API keys for dozens of providers? Or because its CI environment happened to contain a PyPI publishing token that was swept up in a prior credential harvest?

And Telnyx — targeted because it is a telephony SDK deployed in production communications infrastructure? Or because its publishing token was accessible from an environment that had also been exposed?

The distinction matters. If targets are chosen strategically, you assess your risk by asking, "Are we a high-value target?" If targets are discovered opportunistically through credential dumps, the question becomes: "Were any of our publishing tokens accessible from an environment that touched a compromised package?" The second question is harder to answer. And far more organizations are exposed than realize it.

Remediation

If you installed telnyx 4.87.1 or 4.87.2, take these steps immediately:

Remove and pin to the clean version:

Rotate all credentials accessible from the affected environment: cloud provider keys (AWS, GCP, Azure), SSH keys, Kubernetes service accounts, database passwords, publishing tokens (PyPI, npm, Docker Hub, GitHub PATs), and cryptocurrency wallets.

Check for Windows persistence: inspect %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ for msbuild.exe.

Monitor network logs for outbound HTTP to 83[.]142[.]209[.]203:8080 and HTTP POST with X-Filename: tpcp.tar.gz header.

Treat this as a credential-exposure event. If your environment uses Telnyx alongside publishing credentials for other packages, rotate those tokens now. The gap between LiteLLM and Telnyx was three days. The next wave could be shorter.

This is a developing story. Safety's Cybersecurity Intelligence team is actively researching the technical details of the Telnyx compromise.

Safety gives security teams real-time visibility into what's installed and running across developer machines, including AI skills, extensions, and packages that traditional SCA never sees

The Safety Firewall analyzes every package installation request before it reaches public repositories, automatically blocking malicious, vulnerable, and policy-violating packages before they enter your systems. Prevention and observability, not just detection.

Interested in trying Safety? Reach out and we'll get you set up.

Feel free to reach out with any questions!